on successful password change, use 204 (No content) header
return error on incorrect old password